Golang lint and go vet: golangci-lint, formatting, and nolint:gosec

Searches for golang lint, golang linter, golang linting, go linter, go linting, golanglint, go lint, go lint command, linter golang, and nolint:gosec usually mean one of three things: run the go vet analyzer that ships with Go, run a meta-linter such as golangci-lint, or suppress a specific finding (often from gosec) with a //nolint comment. This page separates vetting, formatting (gofmt / goimports), and inline directives, and notes that golint is deprecated. For tabs and style details, see Go formatting.

Tested with Go 1.24 on Linux.

go lint, go vet, and golang lint

• go vet ./... — built into the Go toolchain; catches many real mistakes (Printf format mismatches, wrong struct tags, unreachable code).
• golangci-lint run — community meta-linter that runs many analyzers with caching and config files (common answer for golang lint in larger repos).
• staticcheck ./... — high-signal analyzer suite (go install honnef.co/go/tools/cmd/staticcheck@latest).
• golint — deprecated; do not add it to new workflows (deprecation discussion).

There is no official go lint subcommand in the same sense as go test; when docs say “go lint” they usually mean one of the tools above.

go vet example

go vet flags format-string mistakes the compiler allows:

package main

import "fmt"

func main() {
	name := "Anna"
	score := 99.5
	fmt.Printf("%s got %s points in the Maths exam\n", name, score)
}

go vet ./...

./main.go:7:2: fmt.Printf format %s has arg score of wrong type float64

Fix the verb (%v or %f) instead of silencing the report.

gofmt and goimports (formatting, not lint)

gofmt applies standard formatting. goimports formats like gofmt and fixes import lines. Shell examples:

gofmt -w .
goimports -w .

golangci-lint (golanglint-style workflow)

Install a release that matches your Go version (newer golangci-lint releases may require a newer toolchain than your module). The maintainers document binary installs and shell-based installers here: local installation. If you use go install, the v2 module path looks like:

go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.X.Y

Run from the module root:

golangci-lint run ./...

Configuration lives in .golangci.yml, .golangci.yaml, .golangci.toml, or .golangci.json (see configuration). Start from a small enabled set (for example govet, errcheck, staticcheck) and grow deliberately—avoid copy-pasting huge enable/disable lists that contradict each other.

nolint directives and nolint:gosec

//nolint tells golangci-lint (and compatible tools) to skip issues on the next line (or the whole file if used as a file header). Prefer linter-specific suppressions.

//nolint:gosec limits the suppression to gosec findings—for example weak randomness from math/rand in non-crypto code:

package main

import (
	"fmt"
	"math/rand"
)

func main() {
	//nolint:gosec // demo only; use crypto/rand for secrets
	fmt.Println(rand.Int())
}

A bare //nolint silences every linter on that line; use it rarely. File-level //nolint:govet,errcheck is possible but hides a lot—prefer config issues.exclude-rules for broad, reviewed exceptions.

Summary

Golang lint in 2026 usually means go vet plus golangci-lint run (and often staticcheck), not golint. The phrase go lint is not a first-class subcommand—clarify that when onboarding. //nolint:gosec is the targeted escape hatch for gosec noise; pair it with a short reason and keep formatting (gofmt, goimports) separate from analysis.

References

• go vet documentation
• golangci-lint project
• golangci-lint configuration
• gofmt command
• goimports
• Staticcheck